NEAR Intents says it stopped more than $50m in attempted cross-chain transfers linked to the $387.5m theft from cryptocurrency exchange Bitget.
Its SHIELD system froze about $503,000 during processing, although roughly $166,000 in suspected stolen funds passed through before being stopped. More than $50m in rejected transfers later moved towards other service providers.
Alex Shevchenko, general manager of NEAR Intents, said on 29 September that SHIELD had identified the transactions as suspected stolen funds. NEAR Intents allows users to exchange assets between blockchains through a network of solvers.
Bitget confirmed that approximately $387.5m reached attacker-controlled addresses during its 24 September security breach. The figure was revised upwards from an initial estimate of $351.6m after additional Zcash and Tron assets were traced.
NEAR Intents rejects Bitget bounty
Shevchenko said SHIELD is designed to detect potentially illicit activity before swaps are completed, distinguishing NEAR Intents from services that allow transactions without screening individual wallets.
“Refusing to help launder stolen assets is one of ours,” he said, arguing that permissionless systems still make choices about what their infrastructure allows.
“A financial system where stealing an asset gives you an unrestricted right to monetize it isn’t a freer system,” Shevchenko added. “It is simply a system that protects the thief.”
NEAR Intents will not claim Bitget’s recovery bounty, which offers 5% of eligible assets frozen through a participant’s efforts and a further 5% for funds successfully recovered. Shevchenko said the $503,000 frozen through NEAR Intents would instead be returned through an appropriate legal process, leaving more funds available for Bitget to recover.
THORChain rejects selective intervention
The statement came as Bitget executives and security companies urged THORChain to block attacker-controlled wallets from using its cross-chain liquidity.
Bitget chief executive Gracy Chen asked THORChain to deny services to identified addresses after stolen funds were traced across several networks. Some assets were converted into Bitcoin through cross-chain swaps.
AMLBot traced one route from Tron through USDT0 to Ethereum, where the funds became about 145 ETH. They then passed through THORChain and were converted into approximately 4.59 BTC. About 4 BTC later entered a Wasabi CoinJoin transaction, according to reports citing AMLBot.
THORChain said its emergency controls can halt the protocol but are not designed to freeze individual transactions. An emergency halt, it said, “is not a selective freeze of specific funds or an individual swap.”
Security firm GoPlus disputed that position, citing THORChain’s validator-controlled vaults, Mimir governance controls and ability to halt chain signing. It argued those operational controls differ from the base-layer networks Bitcoin and Ethereum.
Bitget continues recovery effort
Circle and Tether separately blacklisted an Ethereum address linked to the attacker, freezing 99,990 USDC and 218,023 USDT worth about $318,000 in total. Chen thanked both issuers and called on exchanges, custodians, bridges and investigators to assist.
Bitget said the first unauthorised transfers were detected at 18:31 UTC on 24 September. It said attackers exploited a vulnerability in a third-party security product to obtain high-level credentials and send fraudulent withdrawal instructions into its wallet systems. Private keys were not stolen and cold wallets were unaffected.
The vulnerability has been fixed, while Mandiant and SlowMist are assisting with forensic analysis, tracing and recovery. Investigators have followed ETH, XRP, USDT, USDC, USDT0, ZEC, XAUt, BNB, AVAX and TRX across Ethereum, other EVM chains, XRP Ledger, Zcash and Tron.
AMLBot estimated on 25 September that about $343m, or 88% of the funds it was then tracking, remained dormant in 13 linked wallets. Bitget said its Protection Fund would absorb the loss and customer balances would remain unchanged.
Bitcoin withdrawals were scheduled for 28 September, followed by ETH withdrawals on Ethereum, BSC, Arbitrum, Base and Optimism on 29 September. USDT withdrawals were scheduled for 30 September, with remaining token, fiat and peer-to-peer services expected to return on 2 October.
